OmarchybotandCodex XHigh
6d02625f7f
The release script computed the ISO's sha256 and echoed it to the releaser's terminal, where nobody downloading the ISO could ever see it, and the uploader shipped the ISO and its signature but nothing to check the download against. So "verify your download" was not advice anyone could act on. That matters more for this ISO than for most. The offline pacman mirror lives inside the airootfs and is stored uncompressed, and the installer bind-mounts it onto the target's package cache, so pacstrap reads packages straight off the medium. A flipped block there meets no decompressor and no squashfs block checksum on the way; pacman's integrity check is the first thing in the chain to notice, minutes into the install, as "invalid or corrupted package" against a package name that says nothing about the download. The sidecar names the ISO alone rather than the build path, so it verifies from whatever directory it was downloaded into. A release that cannot write it stops, because the sidecar left over from the previous release reads as a checksum for this one. The uploader now tallies every copy instead of letting the last one decide the exit status, and warns when there is no checksum to publish. Co-authored-by: Codex XHigh <codex@openai.com>
73 lines
1.9 KiB
Bash
Executable File
73 lines
1.9 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
MAKE_ARGS=()
|
|
ISO_REF=quattro
|
|
RELEASE_SUFFIX=""
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case $1 in
|
|
--no-make)
|
|
MAKE_ARGS+=("$1")
|
|
shift
|
|
;;
|
|
--rc)
|
|
MAKE_ARGS+=("$1")
|
|
ISO_REF=rc
|
|
RELEASE_SUFFIX="-rc"
|
|
shift
|
|
;;
|
|
-*)
|
|
echo "Unknown option: $1"
|
|
echo "Usage: omarchy-iso-release [--no-make] [--rc] [version]"
|
|
exit 1
|
|
;;
|
|
*)
|
|
if [[ -n "${BUILD_VERSION-}" ]]; then
|
|
echo "Usage: omarchy-iso-release [--no-make] [--rc] [version]"
|
|
exit 1
|
|
fi
|
|
BUILD_VERSION="$1"
|
|
shift
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if [[ -z "${BUILD_VERSION-}" ]]; then
|
|
echo "Usage: omarchy-iso-release [--no-make] [--rc] [version]"
|
|
exit 1
|
|
fi
|
|
|
|
BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
|
|
BUILD_RELEASE_PATH="$BUILD_ROOT/release"
|
|
|
|
# Make ISOs
|
|
if [[ ! " ${MAKE_ARGS[*]} " =~ " --no-make " ]]; then
|
|
echo -e "\e[32mMaking $ISO_REF ISO\e[0m"
|
|
omarchy-iso-make --no-cache --no-boot-offer "${MAKE_ARGS[@]}"
|
|
else
|
|
echo -e "\e[31mSkipping remaking ISOs\e[0m"
|
|
fi
|
|
|
|
# Sign and upload ISO
|
|
latest_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*x86_64-"$ISO_REF".iso | head -n1)
|
|
release_iso="$BUILD_RELEASE_PATH/omarchy-$BUILD_VERSION$RELEASE_SUFFIX.iso"
|
|
cp "$latest_iso" "$release_iso"
|
|
|
|
echo -e "\e[32mSigning $ISO_REF ISO\e[0m"
|
|
omarchy-iso-sign "$release_iso"
|
|
|
|
# The checksum sidecar names the ISO alone, never the build path: it is
|
|
# downloaded next to the ISO and has to verify with `sha256sum -c` from
|
|
# whatever directory the person who downloaded it happens to be in. A release
|
|
# that cannot write it stops here, because the sidecar left over from the last
|
|
# release reads as a checksum for this one.
|
|
iso_sha=$(sha256sum "$release_iso")
|
|
iso_sha=${iso_sha%% *}
|
|
if [[ -z $iso_sha ]] || ! printf '%s %s\n' "$iso_sha" "${release_iso##*/}" >"$release_iso.sha256"; then
|
|
echo -e "\e[31mCould not write the checksum for $release_iso\e[0m" >&2
|
|
exit 1
|
|
fi
|
|
echo -e "\e[32mSHA256 for $ISO_REF ISO: $iso_sha\e[0m"
|
|
|
|
omarchy-iso-upload "$release_iso"
|